Hajra Naz
Apple has recently alerted over a dozen Iranians that their iPhones were targeted with government spyware, according to digital security researchers.
Iranian Civil Society in the Crosshairs
The Miaan Group, a nonprofit focused on digital rights in Iran, and Hamid Kashfi, an Iranian cybersecurity expert based in Sweden, reported that several Iranians received Apple’s spyware threat notifications over the past year.
Bloomberg was the first to report the news.
Spyware Attacks Identified in Iran and Europe
On Tuesday, the Miaan Group released a report on the cybersecurity threats facing Iranian civil society. It confirmed three cases of government spyware targeting individuals—two in Iran and one in Europe—who received Apple alerts in April 2024.
Amir Rashidi, director of digital rights and security at Miaan, said two of the victims in Iran come from a family with a long history of political opposition to the regime. He noted that many of their relatives have been executed, and these individuals have never traveled abroad.
“I believe there have been three waves of attacks,” Rashidi said. “We’ve only seen the tip of the iceberg.”
Iranian Government Likely Behind the Attacks
While further investigation is needed, Rashidi strongly suspects the Iranian government is behind the targeting.
“I see no reason for members of civil society to be targeted by anyone other than Iran,” he added.
Victims Reluctant to Investigate Further
Cybersecurity researcher Hamid Kashfi, founder of the security firm DarkCell, said he helped two victims carry out early forensic checks on their devices. However, he could not confirm which spyware was used.
Many of the affected individuals chose not to continue the investigation.
“Pretty much all victims spooked out and ghosted us,” Kashfi said. “I presume partly because of their work and the sensitive nature of their roles.”
One victim, according to Kashfi, received the alert in 2024.
Unknown Spyware Maker Behind the Attacks
It’s still unclear which spyware vendor was involved. Companies like NSO Group (Pegasus) and Paragon (Graphite) are known for making spyware used in state surveillance. Apple refers to these as “mercenary” or “commercial” spyware.
Apple’s Global Spyware Alerts
Since 2021, Apple has regularly sent threat notifications to people believed to be targeted by government spyware. These alerts have helped uncover surveillance campaigns in India, El Salvador, Thailand, and now Iran.
Apple’s support page, last updated in April, says it has sent such alerts to users in over 150 countries. The company does not name the countries or reveal how many people have been notified.
Help Is Available for Victims
Apple encourages anyone who receives a threat notification to contact AccessNow, a nonprofit that runs a 24/7 helpline with experts who investigate spyware attacks. AccessNow has documented cases worldwide and continues to assist digital rights defenders.
Apple Stays Silent
Apple has not commented publicly on the recent alerts sent to Iranian users.
